T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:59- Finding
Unverified Remote Installer Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Sci Data Extractor
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to match its stated PDF extraction purpose, but its setup and cloud-processing behavior need review before installation.
Review before installing. Prefer the built-in venv/pip or conda setup path instead of running the `curl | sh` uv installer, pin or verify any installation sources, and only process PDFs you are allowed to send to the configured LLM provider or Mathpix. Use a dedicated API key with limits, check the resolved base URL before use, and avoid batch mode for confidential or regulated documents unless the endpoint and provider policy are approved.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
README_ZH.md:58- Finding
Unverified Remote Installer Executed Directly by a Shell in Chinese Documentation
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:36- Finding
Skill Instructions Recommend Direct Execution of a Mutable Remote Script
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
extractor.py:45- Finding
Sensitive PDF Content and API Credentials Can Be Sent to an Arbitrary Configured Endpoint
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (50)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping network-fetched content directly into
shis a classic command-chaining pattern that eliminates any review barrier before execution. In a skill README, this is particularly dangerous because users may copy-paste setup commands verbatim, turning documentation into a one-step remote code execution path if the source is tampered with.- Content
bash # Install uv (if not already installed) curl -LsSf https://astral.sh/uv/install.sh | sh # Create virtual environment and install dependencies in project directory cd ~/.claude/skills/sci-data-extractor
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Piping remote content directly into
shcreates an immediate command-execution path from an external source to the user's shell. In the context of a skill installation README, this is more dangerous because users are likely to copy-paste it verbatim, enabling full host compromise if the fetched script is malicious or tampered with.- Content
bash # 安装 uv（如果还没安装） curl -LsSf https://astral.sh/uv/install.sh | sh # 在项目目录创建虚拟环境并安装依赖 cd ~/.claude/skills/sci-data-extractor
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The shell pipeline ending in '| sh' is a direct command-chaining execution pattern that can lead to arbitrary code execution from remote content. In skill context, this is especially risky because users may copy-paste setup instructions without scrutiny, turning documentation into an execution vector.
- Content
Method 1: Using uv (Recommended - Fastest)
bash # Install uv curl -LsSf https://astral.sh/uv/install.sh | sh # Create virtual environment and install dependencies cd /path/to/sci-data-extractor
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md cp .env.example .env # Edit .env and add your API key # Get API key from: https://console.anthropic.com/ EXTRACTOR_API_KEY=your-api-key-here EXTRACTOR_BASE_URL=https://api.anthropic.com EXTRACTOR_MODEL=claude-sonnet-4-5-20250929
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 创建 .env 文件 cp .env.example .env # 编辑 .env，添加你的 API key # EXTRACTOR_API_KEY=your-api-key-here
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 创建 .env 文件 cp .env.example .env # 编辑 .env，添加你的 API key # EXTRACTOR_API_KEY=your-api-key-here
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md print("安装命令: pip install openai") sys.exit(1) # 加载 .env 文件 try: from dotenv import load_dotenv load_dotenv()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md print("安装命令: pip install openai") sys.exit(1) # 加载 .env 文件 try: from dotenv import load_dotenv load_dotenv()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md print("安装命令: pip install openai") sys.exit(1) # 加载 .env 文件 try: from dotenv import load_dotenv load_dotenv()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md print("安装命令: pip install openai") sys.exit(1) # 加载 .env 文件 try: from dotenv import load_dotenv load_dotenv()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md print("安装命令: pip install openai") sys.exit(1) # 加载 .env 文件 try: from dotenv import load_dotenv load_dotenv()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python print("安装命令: pip install openai") sys.exit(1) # 加载 .env 文件 try: from dotenv import load_dotenv load_dotenv()
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes AI-powered extraction using external LLM and OCR providers, but it does not clearly warn that PDF contents, including potentially sensitive research or unpublished data, may be transmitted to third-party services. This creates a real privacy and data-governance risk because users may assume processing is local when it is not.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # Install uv (if not already installed) curl -LsSf https://astral.sh/uv/install.sh | sh # Create virtual environment and install dependencies in project directory cd ~/.claude/skills/sci-data-extractor uv venv source .venv/bin/activate # Linux/macOS
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The README directs users to configure Mathpix and other API-backed services, confirming that document-derived content may be transmitted off-host to third parties. In the context of a PDF extraction skill, this is security-relevant because scientific PDFs can contain confidential data, proprietary methods, or embargoed research.
- Content
md - **Anthropic Claude**: https://console.anthropic.com/ - **OpenAI**: https://platform.openai.com/api-keys - **Mathpix OCR**: https://api.mathpix.com/ ## Usage
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly describes using external AI and OCR providers to process scientific PDFs and images, but it does not clearly warn that document contents may be transmitted to third-party services. This can lead users to upload unpublished papers, proprietary research, or sensitive data without informed consent, causing confidentiality and compliance issues.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash cd ~/.claude/skills/sci-data-extractor conda create -n sci-data-extractor python=3.11 -y conda activate sci-data-extractor pip install -r requirements.txt
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash cd ~/.claude/skills/sci-data-extractor conda create -n sci-data-extractor python=3.11 -y conda activate sci-data-extractor pip install -r requirements.txt
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents capabilities that involve network access, reading environment variables for credentials, and writing output files, but it does not declare an explicit tool/permission scope. This creates an authorization ambiguity where an agent or user may not realize the skill can transmit document contents externally or access secrets, increasing the chance of overbroad execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises PDF extraction and LLM/OCR use, but it does not clearly warn that uploaded PDF content may be transmitted to third-party providers such as Anthropic, OpenAI, or Mathpix. Users may therefore process unpublished, confidential, or regulated research documents without informed consent about external data exposure.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 78% confidence
- Finding
The documentation instructs users to run
npx skills addwithout pinning a specific package or version. This can cause installation of whateverskillspackage or remote behavior is current at execution time, creating a supply-chain risk if the package is updated maliciously, typo-squatted, or otherwise changes unexpectedly.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains user-facing natural-language strings such as the module docstring, error messages, help text, and examples entirely in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in or documented regional justification is a policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README instructs users to use Mathpix OCR with API credentials but does not warn that PDF contents will be transmitted to an external service. In a scientific-literature extractor, PDFs may contain unpublished, proprietary, or regulated data, so omission of a privacy/data-transfer notice can mislead users into exposing sensitive documents.
- Content
Static analysis
No suspicious patterns detected.